150+ Companies Top Executives are Hacked Via Successful Targeted Phishing Attacks

According to the security group, Group-IB Threat Intelligence, more than 150 companies’ top executives are hacked via successful targeted phishing attacks, they also got evidence regarding corporate email account establishment of an Asia-based company.

Well, they stated that a cybercrime company had breached the email accounts of high ranking executive since-mid 2019. 

This conflict is dubbed as ‘PerSwaysion,’ and it is detected that this cyberattack campaign has leveraged the Microsoft file-sharing assistance including Power, SharePoint, and OneNote to eject extremely targeted phishing attacks. 

Top Executives Targeted

Well, this conflict has mainly focused on the victims of high-ranking officers, and are above 20 Office 365 accounts of executives, presidents, and managing directors.

However, the high-profile victims managed to establish in the US, Canada, whereas, the remaining are in global and local financial centers such as Germany, UK, Netherlands, Hong Kong, and Singapore, and many other countries.

After getting all the data by using the server IMAP APIs, next, they create a PDF file that contains the data of the current victim, such as full name, email address, legitimate company name. Once they are done with the PDF file, next, they will send these files to a choice of new people who serve to be external of the victim’s organization and carry essential professions. 

Once the operators of PerSwaysion conducted new spear-phishing operations from a negotiated account, they just delete the representing emails from the outbox folder to evade disclosure, said the Group-IB.

At first, Group-IB was inadequate to identify the motive of the hackers, as they are gaining access only to the email accounts.

Thus there are three steps by which PerSwaysion’s whole scheme could be detected to avoid traffic detection and automated threat intelligence gathering:-

• Initially, each victim gets an email carrying a regular PDF file as an email attachment. Once the victims unlocked the file, they would be demanded to tap a link to inspect the original content.
• After opening the link, it will redirect the victims to a Microsoft Sway page, where a related file would summon the victim to tap on another link.
• And this final link will redirect the victims, or we can say the officer to a page, imitating the Microsoft Outlook login page, where hackers will quickly accumulate the victim’s essential data.

The operator of the PerSwaysion campaign always move fast from the very first moment to accomplish a successful phish and usually obtained access to the hacked email accounts within a day. Group-IB stated that approaching on prevailing evidence, the PerSwaysion group resembles to be composed of members from Nigeria and South Africa, and are utilizing a phishing toolkit produced and created by a Vietnamese programmer. 

More importantly, the group’s chief seems to be a defendant operating by the name of “Sam.” As we said above that PersDwaysion generally deletes all the data after they are done with the hacking process. 

Thus there’s no explicit confirmation on how attackers are utilizing negotiated corporate data. Well, many researchers consider that these data can be sold to other financial scammers to carry out regular financial scams.

Therefore, Group-IB has made an online web-page where everyone can easily verify if their email address was yielded as a component of PerSwaysion attacks or not. And they also said that one should just use it for entering your email if you’re profoundly anticipating being attacked.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read:

Microsoft Announced a Defender Antivirus for Linux – Android & iOS Version Coming Soon

Microsoft Data Leak – 250 Million Microsoft Customer Service Support Records Exposed Online

Hackers Exploiting Microsoft Sharepoint Vulnerability to Hack Government Organization Networks